The zero1zerouk Login Page Editor WordPress plugin is vulnerable to CSRF due to missing nonce validation on the devotion_loginform_process() AJAX action in all versions up to and including 1.2. This allows an attacker to craft a forged request that, if executed by a logged-in administrator (via user interaction like clicking a link), can update the plugin's login page settings without proper authorization. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed, and limited impact confined to integrity.

An attacker can cause unauthorized changes to the login page settings of the affected WordPress plugin by exploiting the CSRF vulnerability. This does not disclose sensitive information or disrupt service but may allow manipulation of login page behavior, potentially aiding further attacks or causing administrative confusion. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider disabling or removing the vulnerable plugin if possible.